Pro-Kremlin network spreads fake Politico tomato hoax
DFRLab traced a coordinated pro-Kremlin disinformation campaign that fabricated a Politico story about EU rejecting Armenian tomatoes, spreading it in 18 languages within 29 hours.
Sourcedfrlab.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
DFRLab and CivilNet documented a coordinated influence operation that fabricated a Politico news story claiming the EU had rejected Armenian tomato imports, inverting the actual fact that Russia had embargoed Armenian agricultural goods ahead of Armenia's June 2026 parliamentary elections while the EU opened its market. The false claim was seeded on a Russian-language Telegram channel (@indeec_1937) on July 22, 2026, and within minutes appeared on a verified X account (@SprinterPress, part of the pro-Kremlin 'Sprinter' network) and spread to Space.ru mirrors, Facebook groups, and Belarusian state TV. The operation exploited genuine Armenian farmer protests to push narratives discrediting PM Pashinyan and the EU, timed to undermine Armenia's westward orientation.
Analysts used the Erebus Toolkit and byte-level image hashing to establish coordination across four platforms (Telegram, X, Facebook, VK), identifying automated translation pipelines, synchronized multilingual posting clusters (Russian-German-French within 30 seconds, 413 instances observed over two months), and fixed-sequence amplification chains involving Armenian outlet Past.am and four Telegram channels. Key amplifiers included pro-Kremlin military blogger Yury Podolyaka (73 posts across 64 channels), the ANNA NEWS Telegram channel, the Pravda Network mirror sites, and 74 X accounts with documented ties to the Storm-1516 influence operation targeting Armenia and the Baltic states. The false story reached eighteen languages, including Korean and Vietnamese, within 29 hours, with word-for-word identical text indicating centralized translation and distribution rather than organic spread.
For defenders and trust & safety teams, the report is valuable less for its specific claim than for the reusable disinformation infrastructure it exposes: persistent mirror sites, automated cross-posting bots with near-zero-second republication latency, page-like inauthentic Facebook accounts, and verified/high-follower X accounts pre-positioned to amplify Kremlin-aligned narratives on demand. This infrastructure predates the campaign and remains active, meaning similar fabricated-attribution hoaxes attacking other countries' EU/Western relations should be expected using the same channels and techniques.
Mentioned in this report
Source reporting: https://dfrlab.org/2026/09/29/russia-banned-armenian-tomatoes-a-fake-politico-story-blamed-europe
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs